Deleted files in Windows: Recycle Bin, Shift+Delete, and what to do next

The short answer: When you delete a file using the Delete key, it is merely moved to the Recycle Bin and can be restored with two clicks. When you use Shift+Delete or empty the Recycle Bin, the entry in the file system index disappears—but the data itself remains on the drive until something overwrites it. That is why the worst response is to install „data recovery software" on the affected drive: the installation writes to the very space where your files may still be waiting. With hard drives, you often have hours or even days; on an SSD, TRIM may make the data irretrievable within moments. Stop using the affected drive and perform the recovery from elsewhere.

A deleted file is the most common type of „data loss" people call us about—and also the one where the outcome depends most heavily on what you do in the first few minutes. This article explains deletion in Windows: what happens in the Recycle Bin, what happens after Shift+Delete, and why the order of your next steps matters more than which tool you choose.

Check the Recycle Bin first—the only free, risk-free step

Deleting a file with the Delete key or via the context menu does not erase it. It only moves the file to the hidden Recycle Bin folder on the same volume. Open the Recycle Bin, find the file, select Restore, and it will return to exactly where it came from.

Two things often surprise people:

  • Each volume has its own Recycle Bin. If you deleted a file from an external drive or another partition, reconnect that same drive and look for it there.
  • The Recycle Bin does not work on network drives or most USB flash drives and memory cards—deletion is immediately permanent on those devices. The same applies to files larger than the configured Recycle Bin capacity.

If the file is in the Recycle Bin, stop reading and restore it. Everything else in this article applies to situations where it is not there.

Shift+Delete and an emptied Recycle Bin: what actually happened

A file system works much like an index in a book. When you „permanently delete" a file, the system crosses out its entry in the index and marks its space as available. The text remains in the book—there is simply no longer anything pointing to it.

  • On NTFS (the standard Windows system drive file system), the file’s record in the Master File Table, or MFT, is released and its space is marked as free in the bitmap. Until a new file overwrites that record, it may still contain the filename, size, and a map of where the data is stored—which is why NTFS recovery is often relatively accurate.
  • On exFAT and FAT32 (used by most flash drives and memory cards), the situation is worse: the information describing where the file continues can fall apart. Files stored in contiguous blocks can often be reconstructed, but fragmented files frequently cannot. This is why recovery from flash drives often produces „something," but not a complete result.

Quick formatting, deleting a partition, and „resetting the PC to factory settings" fall into the same category. None of these operations necessarily erases the data—they remove the pointers to it. There is one important difference, however: the system immediately starts using a newly formatted volume for new files.

Why you must not write to the affected drive

This is the most important sentence in the entire article: from the moment a file disappears, every write to that drive gambles with the exact data you want to recover.

And this is where people most often fall into a trap. Someone realizes they have deleted a folder containing photos or accounting records, opens a browser, finds „deleted file recovery software," and installs it. But then:

  • the download saves the installer to the system drive,
  • the installation extracts dozens of files into the free space created by the deleted data,
  • the browser, Windows Update, indexing, antivirus software, and OneDrive continue writing in the background,
  • and the recovery program then faithfully reports that most of the files it found are „corrupted."

The drive did not corrupt them. The installation did.

The safe order is as follows:

  1. Stop using the affected drive. If it is the system drive, shut the computer down—do not put it to sleep; turn it off.
  2. Do not install or save anything on it. No recovery tool, antivirus scan, or CHKDSK. The article CHKDSK on an external drive: when it helps and when it causes harm explains why CHKDSK in particular can be damaging.
  3. Connect the drive to another computer or create a disk image. For an external drive, simply connect it to another computer. Remove a system drive and connect it to another machine using a docking station or adapter—or boot the computer from a live system on a USB drive.
  4. Recover files to a different storage device from the one you are reading. Never restore them to the same drive.

HDD versus SSD: where recovery is possible and where TRIM decides

The difference between a spinning hard drive and an SSD is crucial when recovering deleted files, and it is important to be clear about it from the start.

With a hard drive, the traditional rule applies: data remains on the platter until a new write overwrites it. If you stop using the drive immediately, the chance of recovery is often high.

With an SSD, TRIM comes into play. When the system deletes a file, it tells the drive that the corresponding blocks are no longer needed. The controller can then physically clear them at any time so that free cells are ready for future writes. Windows also performs scheduled volume optimization, which includes retrim on SSDs. Exactly when the released data is erased depends on the drive controller and cannot be predicted or stopped externally. That is why an SSD containing valuable deleted data should not be left running until a convenient time—it should be shut down immediately.

SituationRealistic chanceWhat to do
File in the Recycle Bin (HDD or SSD)virtually certainrestore it from the Recycle Bin; no further action needed
Shift+Delete on an HDD that was immediately taken out of usegooddisconnect the drive and recover it from another computer to different storage
Shift+Delete on an HDD while the computer continued running for several daysdecreases with each daystop using it; the sooner, the better
Shift+Delete on an internal SSD (SATA or NVMe) with TRIM enableduncertain, often zeroshut it down immediately; waiting will not improve the odds
Quick format of an NTFS volumeoften gooddo not write anything to the volume; work from a disk image
Windows reinstalled over the original systemsignificantly worsethe installer overwrote data; only remnants may be recoverable
Deletion from a network drive or NASdepends on snapshotslook for volume snapshots, not recovery software

External SSDs introduce another complication: the USB bridge may or may not pass the TRIM command through to the drive. It depends on the particular enclosure and driver, and you cannot safely assume either outcome in advance. The article SSD data recovery: why it is harder than recovering data from an HDD explains why SSD recovery is generally a different discipline.

The often-overlooked first aid: versions and backups

Before reaching for recovery software, check three places where the file may still exist—and where you can retrieve it without writing a single byte to the affected drive:

  • File History / Windows Backup. If enabled, it keeps older versions of documents and allows you to restore them from an earlier point in time.
  • OneDrive. It provides two separate features: restoring deleted files and folders from its online Recycle Bin, and viewing the version history of an individual file. Both can work even after the file has disappeared from the computer.
  • Previous Versions in the folder properties. These are based on volume shadow copies and are often enabled on company workstations without the user realizing it.

For business data, also check email attachments, shared folders, NAS snapshots, and the latest overnight backup. Before attempting recovery, it is worth spending five minutes looking for a copy that never disappeared in the first place.

When software is enough and when you need a laboratory

Recovery software makes sense only when all of the following conditions are met: the drive is physically healthy (it makes no unusual sounds, does not disappear from the system, and reports no read errors); the problem is deletion or a quick format with no subsequent use of the drive; you are reading the connected drive from a different computer; and you are recovering files to a different storage device. Microsoft also provides its own Windows tool—Windows File Recovery—which can be a good starting point if you are comfortable using the command line.

The drive belongs in a laboratory if any of the following applies:

  • the drive clicks, grinds, beeps, disappears from the system, or disconnects while being read,
  • read errors occur or the volume appears as RAW,
  • it is an SSD and the data is genuinely important,
  • CHKDSK, formatting, a reinstallation, or several recovery programs have already been run on the drive,
  • the volume is encrypted with BitLocker and you do not have the recovery key,
  • it is a RAID array, NAS, or virtual disk,
  • the lost data consists of accounting records, client work, databases, or the only copy of your photos—in other words, anything for which there will be no second attempt.

If you are unsure which category your situation falls into, leave the computer switched off and contact us or call our data recovery line at 775 556 063. The price depends on the type of failure and the work required, not the drive capacity. You can find indicative prices in how much does hard drive data recovery cost?.

Frequently asked questions

Can a file be recovered after Shift+Delete?

Often, yes—but timing and what happened to the drive afterward are decisive. Deleting the file removed its file system entry, not the data itself. The data remains on the drive until a new write overwrites it. The chance of recovery is often high with a hard drive that was taken out of use immediately. On an SSD, TRIM may make the file irretrievable almost instantly.

Can I install recovery software on the drive?

Not on the affected drive. Installation writes files into the very free space created by the deleted data, and this is the most common reason why a recoverable situation becomes unrecoverable. Install the software on another computer and connect the affected drive to it, or boot from a live system on a USB drive—and always recover the files to different storage.

I emptied the Recycle Bin. Is the data permanently gone?

Emptying the Recycle Bin removes the reference, not the contents. On a hard drive, the data will usually continue to exist for some time. The key is to stop using the drive—especially do not download or install anything else, because the system will offer the newly released space to the next new file.

Why is recovering data from an SSD harder than from an HDD?

Because an SSD does not wait passively. After deletion, TRIM tells it that the blocks are no longer needed, and its controller may clear them automatically to prepare free cells. Windows also runs scheduled volume optimization, which includes retrim for SSDs. The drive controls when this happens, and it cannot be stopped externally.

Where can I find an older version of a file if recovery fails?

Check File History or Windows Backup, shadow copies through Previous Versions in the folder properties, and OneDrive—which provides a separate online Recycle Bin for deleted files and a separate version history for individual files. For business data, also check email attachments, shared drives, and NAS snapshots.

I deleted files from a flash drive. Do the same rules apply?

The basic rule does: do not write anything to it. However, the vast majority of flash drives do not have a Recycle Bin, so deletion is immediately permanent. Their file systems—usually exFAT or FAT32—also retain less information about file placement than NTFS. The article flash drive data recovery covers flash-drive-specific issues, including physical damage.

Sources